I remember when the maintainer of an open source XML library contacted dozens of companies for support to fix a critical vulnerability, and most of them didn't even respond and aside from two the rest went basically "not our problem, get lost".
A handful of companies probably care a bit but most won't bother to pay even a penny.
There’s a difference between assigning resources to a problem and taking on the responsibility for a utility and just donating money no strings attached with no accountability and potential positive press.
It was possible to just donate money with no strings attached actually, and one of the two companies that helped did just that. And positive press was also involved.
A handful of companies probably care a bit but most won't bother to pay even a penny.